Extracted

• • Target

    fd10236f59e0f351586cfee4f6c44fe0_JaffaCakes118

  • Size

    440KB

  • MD5

    fd10236f59e0f351586cfee4f6c44fe0

  • SHA1

    549703710fe73fdacb48c958ca2d5979d160a9d6

  • SHA256

    a10dea1a440b70d5f62ce3cc1f2dbe665c9e2a8b6293a692946e62b522829124

  • SHA512

    1f0630b97b69d9342df5ef41c6af87640b9fd9545caaf67f70565bac2f6e94e772cc53e1e98dc10057af860d1539c1ac676417c99ffcf46c40ab3428df6dbb88

  • SSDEEP

    6144:RmhQFSEeQ44ZfZUhzwP3v9GPiEtQ5Bak4gSP0srdKcDVcnbY1TWMqfotU:shQavMUhzwP3vxCQ6H/ldf+bYNWTl

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2